case()

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Evaluates a list of predicates and returns the first result expression whose predicate is satisfied.

If none of the predicates return true, the result of the else expression is returned. All predicate arguments must be expressions that evaluate to a boolean value. All then arguments and the else argument must be of the same type.

case(predicate_1, then_1, [predicate_2, then_2, ...] else)

Learn more about syntax conventions.

The value of the first then_i whose predicate_i evaluates to true, or the value of else if neither of the predicates are satisfied.

range Size from 1 to 15 step 2
| extend bucket = case(Size <= 3, "Small", 
                       Size <= 10, "Medium", 
                       "Large")

Output